nuclei-templates/http/exposures/backups/php-backup-files.yaml

139 lines
3.8 KiB
YAML

id: php-backup-files
info:
name: PHP Source - Backup File Information Disclosure
author: StreetOfHackerR007,pwnhxl,mastercho,0xpugazh
severity: medium
description: PHP Source File is disclosed to external users.
metadata:
max-request: 1512
tags: exposure,backup,php,disclosure,fuzz
http:
- method: GET
path:
- "{{BaseURL}}{{filepath}}{{bakext}}"
attack: clusterbomb
payloads:
filepath:
- /wp-config.php # wordpress
- /wp-config # wordpress
- /site/default/settings.php # drupal
- /installation/configuration.php # joomla
- /app/etc/env.php # magento
- /Application/Common/Conf/config.php # thinkphp
- /environments/dev/common/config/main-local.php # yii
- /environments/prod/common/config/main-local.php # yii
- /common/config/main-local.php # yii
- /system/config/default.php # opencart
- /typo3conf/localconf.php # typo3
- /config/config_global.php # discuz
- /config/config_ucenter.php # discuz
- /textpattern/config.php # textpattern
- /data/common.inc.php # dedecms
- /caches/configs/database.php # phpcms
- /caches/configs/system.php # phpcms
- /include/config.inc.php # phpcms
- /include/config.php # xbtit
- /includes/config.php # vbulletin
- /includes/config # vbulletin
- /phpsso_server/caches/configs/database.php # phpcms
- /phpsso_server/caches/configs/system.php # phpcms
- /zb_users/c_option.php # zblog
- /e/class/config.php # empirecms
- /e/config/config.php # empirecms
- /data/sql_config.php # phpwind
- /data/bbscache/config.php # phpwind
- /app/config/parameters.yml # prestashop 1.7
- /app/config/parameters.php # prestashop 1.7
- /config/settings.inc.php # prestashop > 1.5,1.6
- /config/settings.old.php # prestashop > 1.5,1.6
- /manager/includes/config.inc.php # MODX CMS
- /app/config/parameters.ini # Symfony
- /db.php
- /conn.php
- /database.php
- /db_config.php
- /config.inc.php
- /data/config.php
- /config/config.php
- /index.php
- /default.php
- /main.php
- /settings.php
- /header.php
- /footer.php
- /login.php
- /404.php
- /wp-login.php
- /config.php
- /config
- /const.DB.php.bak
- /const.DB.php
bakext:
- ".~"
- ".bk"
- ".bak"
- ".bkp"
- ".BAK"
- ".blank"
- ".swp"
- ".swo"
- ".swn"
- ".tmp"
- ".save"
- ".old"
- ".new"
- ".orig"
- ".dist"
- ".eski" # Turkish word for .bak its common on file backups
- ".txt"
- ".disabled"
- ".original"
- ".backup"
- "_bak"
- "_1.bak"
- "~"
- "!"
- ".0"
- ".1"
- ".2"
- ".3"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: body
words:
- "<?php"
- "<?="
condition: or
- type: word
part: body
words:
- "?>"
- "($"
- "$_GET["
- "$_POST["
- "$_REQUEST["
- "$_SERVER["
- "'DB_PASSWORD'"
- "'DBPASS'"
- "database_type"
- "define('DB"
condition: or
- type: word
part: header
words:
- "text/plain"
- "bytes"
condition: or
# digest: 4a0a0047304502203f2aa5efbaa9a74b1acd13a904876f24d40a7f0de436fe97aa7b737a1083d39a0221009f9a905d1d5ad08f8a531ac0063d0483674c70282bd3a056934f5ab06ff510aa:922c64590222798bb761d5b6d8e72950